APT34
Attribution profile
- Type
- Nation State
- Location
- Iran
- Known incidents
- 5 incidents
- Sources
- 2 sources
- First seen
- 2016-01-01
- Last seen
- 2020-01-23
- Updated
- 2026-10-13 19:59
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
APT34, also known as OilRig and Helix Kitten, is an Iranian state‑sponsored threat group linked to the Ministry of Intelligence. The group conducts cyber espionage and disruptive operations against private sector entities and government targets in the Middle East, Europe, and the United States, with a focus on oil and gas, aviation, and technology firms. Observed tactics include spear‑phishing that uses compromised digital certificates to deliver Helminth malware, fake Oxford University job‑offer pages, and phishing emails spoofing legitimate accounts such as Turkish Airlines or Saudi Arabian contractors. Initial access is often gained via VPN vulnerabilities or stolen credentials, followed by privilege escalation through domain controllers. The group deploys custom backdoors such as Poison Frog and Glimpse, and has employed data‑wiping malware including a Dustman variant (derived from ZeroCleare) that uses EldoS RawDisk, as well as Shamoon‑like wipers that overwrite master boot records and propagate via SMB. Notable public operations include the December 2019 Dustman attack on Bahrain’s national oil company, the 2020 aviation‑focused cyber campaign targeting an Israeli airport and aircraft of visiting world leaders, and the 2018 Shamoon‑variant incident against an Italian oil and gas company. The group’s infrastructure and tools were exposed in March 2019 by the Lab Dookhtegan leak, which revealed internal data, custom tools, and member personal information.
Incidents
Attributed incidents are available to members.
5 incidentsSources
Sources available to members: 2 sources.